The whole utmp stuff is flaky, a best effort system that might give some resemblance to reality.
All who does is read the database. It is up to all of the other systems that might write to it to do the correct thing with regards to adding and removing entries. man -s 5 utmp Goes into more detail (likely more than you want to know for this particular problem). mrc
